Privacy Policy

1. Information we handle

• Account information. When you create an account, we process your email address, account identifier, authentication information, and account timestamps. Supabase handles authentication, including your password and sign-in sessions.
• Agreement records. After onboarding, we record the versions of the Terms of Service and Privacy Policy you acknowledge and the time you accept. You can accept without creating an account. That choice is saved on your device and can be linked to your account when you later sign in. Account-linked records are also sent to Supabase with a server recording time, so your account can restore its acceptance on another device. These records document your agreement and the notice provided; they do not grant permission for unrelated data uses or replace separate device permissions or legally required consent.
• Location and route information. With your device permission, the app can access your current or last-known location to center the map and help choose a starting point. You can also select points on the map or search for a place. Route requests include chosen coordinates, activity, target distance, and route preferences. Generated routes can contain precise coordinates, distance, elevation, turn instructions, and other route details.
• Saved routes and preferences. Routes you save, including their names, geometry, activity, and related details, are stored on your device. When you are signed in, the app automatically attempts to sync saved routes with your account in cloud storage. Offline saves and deletions may sync later when you reconnect and use the app. The app also stores settings and onboarding progress locally. If you set up an iPhone Home Screen widget, the selected route's details and map image are stored locally for the widget and displayed on your Home Screen. People who can see your Home Screen may see those details.
• Subscription and usage information. We and RevenueCat process your app account identifier, purchase and transaction information, subscription status, and information needed to display and operate paywalls, validate purchases, and restore access. We maintain route-generation usage counts and related timestamps to apply plan limits. Apple processes App Store payments; we do not receive your payment-card details. On an iPhone, RevenueCat can associate your account identifier with a customer record when you sign in, before you open a paywall or make a purchase.
• Technical information. Our hosting and service providers receive network information such as IP addresses and request metadata. Operational records can include request identifiers, API paths, response status, timing, errors, and route-quality statistics. Subscription services can also process app, device, platform, and paywall-interaction information to provide their services. Subscription SDK metadata can include the device's advertising-permission status.
• Launch notifications. If you join the website waitlist, we store your email address, signup time, and which signup button you used. An internal signup alert also sends your email address and signup source to our support inbox. We use the signup information for the one-time launch note you requested. You can ask us to remove your signup by emailing support@getrouteplanner.com.
• Support messages. If you contact us, we receive your email address and the information you choose to send.

When you explicitly start an activity, the app uses continuing precise location updates to show your position, follow the selected route, estimate progress, and identify turns, route completion, and when you may be off-route. With separate background location permission and a compatible device build, those updates can continue while the screen is locked or you use another app. Without background permission, the activity pauses when the app goes into the background. Tracking stops when you pause or end the activity, complete the route, or leave the account that started it, including account deletion. An activity is not restored after the app process restarts; any orphaned native tracking task is stopped when the app or task next runs.

Live position and navigation progress are held in app memory for the current activity. RoutePlanner does not save a GPS track, workout history, or past activity location history, or upload that live position stream to its backend, Supabase, GraphHopper, or RevenueCat. Map requests can continue as the map moves and reveal the area being viewed to MapTiler. Location permission remains optional for planning: you can choose a starting point manually or search for a place.

2. How we use information

We use information to authenticate accounts; display maps and place-search results; generate, preview, follow, save, sync, and export routes; provide on-screen activity guidance; provide and restore subscriptions; apply usage limits; remember the terms and privacy notice you acknowledged; send requested launch notifications; respond to support requests; protect against abuse; diagnose problems; and maintain and improve the service. We also use information when necessary to meet legal obligations.

We do not sell your personal information or share it for targeted advertising. The app does not include third-party advertising SDKs.

3. Service providers and sharing

We use the following providers to operate RoutePlanner. They receive the information needed for their part of the service:

Apple and other services may also handle information under their own privacy policies. We may disclose information when required by law, to protect people or the service, or as part of a business transfer, subject to applicable privacy requirements.

GraphHopper's privacy policy says it stores API request information, including request bodies, headers, IP addresses, and times, for up to five weeks to prevent misuse and improve its service. RoutePlanner sends routing requests through its backend rather than directly from your device. Deleting your RoutePlanner account does not itself erase previously processed provider logs.

When you export or share a route, the destination you choose receives the exported route, including its precise coordinates. Those services handle it under their own policies. Exporting a route does not give RoutePlanner access to your watch or fitness-platform account.

4. Storage, retention, and security

We keep account information and cloud-saved routes until you delete them or your account; inactive accounts do not automatically expire. Usage and subscription-access records support your plan. Signing out does not by itself erase locally saved routes. Active navigation uses temporary in-memory position and progress, rather than a stored movement history. Pausing stops new location updates while retaining the current activity in memory so you can resume; ending the activity or restarting the process clears that activity state. Saved routes describe the planned route and may contain its turn instructions, not a recorded path you traveled.

Agreement records. A guest acceptance stays on that device until it is linked to an account, replaced by a newer acceptance, or app storage is cleared. Account-linked document versions and acceptance timestamps remain for the life of the account and are removed from our active account data when account deletion is accepted. The app also attempts to remove that account's local acceptance during device cleanup. Reinstalling the app or clearing its storage can remove an unlinked guest acceptance; signing out does not delete the server's account-linked record.

Deleting a cloud-saved route removes its saved content. We keep account-linked route identifiers, revisions, and deletion state for the life of the account to prevent an older device copy from automatically restoring the route. These records contain no route names or coordinates and are removed when account deletion is accepted.

Limited account-deletion records help finish interrupted requests and prevent reuse of a deleted account identifier. They contain hashed identifiers, receipt references, status, timestamps, and retry information, and currently have no scheduled expiry. The original account identifier is kept while server cleanup is pending and removed from this record when that cleanup completes. These records do not contain saved-route content; hashing does not make them anonymous.

Waitlist. Waitlist entries and internal signup emails are separate from app account data. We keep them for up to 12 months from your original signup date and remove them earlier when the requested launch notification is complete or you ask us to remove your signup. These removals are handled manually. You can request removal by email; deleting an app account does not automatically remove a waitlist signup.

Temporary GPX files. Sharing a route creates an app-owned temporary export. The app attempts cleanup after a sharing grace period when it starts, returns to the foreground, remains active, or prepares another export. Cleanup may be deferred or retried, including during account deletion, and has no guaranteed deadline while the app is closed. Copies you save or share to other apps or storage locations must be managed there.

Support correspondence. Ordinary resolved support conversations become eligible for deletion 12 months after resolution. We review and delete expired conversations quarterly, so removal can occur at the next review rather than on the exact anniversary. Unresolved matters, or information needed for legal obligations, security, or an ongoing dispute, may be kept longer as necessary.

Provider logs, backups, email-delivery records, and store transaction records have separate retention practices. Removing active account data does not immediately remove older backups. We do not promise a fixed deletion period for those records or copies held by others.

We use authentication, account access controls, and encrypted network connections to help protect information. No storage or transmission method is completely secure. Information may be processed outside your state, province, or country, including in the United States and other countries where our providers operate. It may be subject to those countries' laws and lawful access by their authorities.

5. Your choices and deletion

• Location. Change or revoke RoutePlanner's foreground or background location permission in your device settings. Pause or end an activity to stop its location updates. Background permission is optional; without it, keep the app open for activity guidance. You can continue planning from manually selected points without location permission.
• Routes. Use the app's saved-route controls to remove routes. Offline deletions may sync later; devices need to reconnect and use the app to reflect changes. After a deletion is recorded by our server, an older device copy cannot automatically restore that cloud route. An intentional Undo or new save can restore it. Older app versions and deletions made before this protection was introduced may have different behavior. Copies you exported or shared must be managed in their destination.
• Account deletion. Open the app's account screen and choose Delete account. This initiates a deletion request. Once accepted, it cannot be undone: account access is blocked and our account profile, cloud-saved routes, route-sync records, usage data, agreement records, and account-linked subscription event records are removed. Our server retries remaining cleanup, including requesting deletion of the RevenueCat customer and removing the Supabase sign-in account. Completion of our server cleanup does not confirm erasure of every provider copy or backup. If this option is unavailable, contact support for help.
• Subscriptions. Deleting your RoutePlanner account does not cancel an Apple subscription. Cancel it separately in Apple's subscription settings. Account deletion requests the RevenueCat customer cleanup described above; it does not erase Apple's billing records. Providers may retain information for their legal, security, or transaction obligations.
• Privacy requests. Email support@getrouteplanner.com to request access to, a copy of, correction of, or deletion of your personal information, withdraw consent, or make a privacy complaint. You can also ask us to coordinate a request with a service provider. We may need to verify your identity before acting.

After account deletion is accepted, the app attempts to clear that account's local saved routes, sync information, usage cooldown, widget selection and images, and temporary GPX files, detach its subscription identity, and sign out. Failed or deferred cleanup is retried on later app visits. General settings and onboarding preferences remain. This does not remotely erase another device's files, exported copies, support emails, or waitlist signups. Limited deletion-recovery records remain as described above.

Rights and exceptions depend on the laws that apply to you, including your U.S. state or Canadian province. We respond within applicable legal deadlines. You may also contact the privacy regulator responsible for your jurisdiction.

6. Website and local storage

The website introduces the app and hosts this policy; it does not provide app account registration or route generation. Its optional waitlist is described above. Visiting the website sends ordinary request information to website and media hosting providers, which may use cookies or storage for security and delivery.

The website includes Cloudflare's performance analytics script. Cloudflare describes this service as measuring visits and performance without analytics cookies or local-storage tracking. Delivery and security processing are separate. We do not use this measurement for targeted advertising. The website does not change its practices in response to a browser's Do Not Track signal.

The app uses local storage for sign-in sessions, saved routes, sync and deletion recovery, agreement records, widgets, settings, and onboarding progress. Mapping software may also cache map resources. Revoking location permission does not erase previously saved or shared routes.

7. Audience

RoutePlanner and its launch-notification waitlist are intended for people aged 14 and older. If you believe a child under 14 has provided personal information, contact us so we can investigate and address it, including deleting information where required by applicable law.

8. Changes and contact

We may update this policy as RoutePlanner changes. We will revise the date above and provide additional notice or request consent where required by law.

Contact the RoutePlanner owner, responsible for privacy, at support@getrouteplanner.com for privacy questions or requests.